Re: [stella] What's the purpose of address $29E?

So what are your theories on why this was done? Maybe to confuse us that
reverse-engineer their code :-)

It means that D7 will be set on a read of $285 when the timer expires,
which
can be useful if the code can't spin on INTIM. In this case since TIM8T
is
used, there's only 8 cycles between when INTIM = 0 and when it rolls over
to -1 and starts counting the number of cycles since the timer expired.
So
the programmer might have decided it was better to test $285 rather than
miss INTIM = 0 and get stuck for 256 cycles until the rollover counter
finally times out. (I've had this happen for certain values of TIM64T
when
my INTTIM loop included a STA WSYNC.)

The interrupt flag is set regardless of whether the IRQ is enabled. Perhaps
the documentation the programmer was using didn't make this clear, or they
just didn't read it properly or something. Writing to $29e rather than $296
only enables the RIOT's IRQ pin on timeout, which has no benefit on the
2600.